An Intrusion Response Decision-Making Model Based on Hierarchical Task Network Planning

Publication Type

Journal Article

Publication Date

2010

Abstract

An intrusion response decision-making model based on hierarchical task network (HTN) planning is presented in the paper. Compared with other response decision-making models, the response decision-making model consists of not only the response measure decision-making process but also response time decision-making process that is firstly proposed in the paper. The response time decision-making model is able to determine response time for different response HTN subtasks. Owing to the introduction of the response time decision-making, the intrusion response system can apply different response strategies to achieve different response goals set by administrators. The proposed response measure decision-making model can optimize a response plan by balancing the response effectiveness and the response negative impact in both a single response measure and a set of response measures. The response decision-making model is self-adaptive and has the ability of tolerating to false positive IDS alerts. The proposed model has been used in the intrusion detection alert management and intrusion response system (IDAM&IRS) developed by us. The functions and architecture of IDAM&IRS are introduced in this paper. In addition, the intrusion response experiments of IDAM&IRS are presented, and the features of the response decision-making model are summarized.

Keywords

Automated intrusion response system, Hierarchical task network planning, Intrusion response decision-making, Intrusion detection

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

Expert Systems with Applications

Volume

37

Issue

3

First Page

2465

Last Page

2472

ISSN

0957-4174

Identifier

10.1016/j.eswa.2009.07.079

Publisher

Elsevier

Additional URL

http://dx.doi.org/10.1016/j.eswa.2009.07.079

Link to Full Text

Share

COinS